mirror of
https://github.com/zitadel/zitadel.git
synced 2026-10-25 07:37:43 -05:00
Max Peintner
e53373f387
# Which Problems Are Solved
Add pnpm overrides to resolve two security vulnerabilities in transitive
dependencies:
node-tar (CVE-2026-23745): Arbitrary file overwrite and symlink
poisoning via insufficient path sanitization — fixed by overriding to
>=7.5.3
Rollup 4 (#477): Arbitrary file write via path traversal — fixed by
overriding to >=4.59.0
# How the Problems Are Solved
applied overrides in package.json
(cherry picked from commit dad4565d5d)
26 lines
571 B
JSON
26 lines
571 B
JSON
{
|
|
"packageManager": "pnpm@10.30.3",
|
|
"private": true,
|
|
"name": "@zitadel/zitadel",
|
|
"pnpm": {
|
|
"overrides": {
|
|
"form-data@>=4.0.0 <4.0.4": ">=4.0.4",
|
|
"csstype": "3.1.3",
|
|
"tar@<7.5.3": ">=7.5.3",
|
|
"rollup@>=4.0.0 <4.59.0": ">=4.59.0"
|
|
}
|
|
},
|
|
"scripts": {
|
|
"changeset": "changeset",
|
|
"clean:all": "pnpm run clean && rm -rf .nx node_modules"
|
|
},
|
|
"devDependencies": {
|
|
"@bufbuild/buf": "^1.65.0",
|
|
"@changesets/cli": "^2.29.8",
|
|
"nx": "21.6.9",
|
|
"sass": "^1.97.3",
|
|
"shiki": "^3.21.0",
|
|
"wait-on": "^9.0.3"
|
|
}
|
|
}
|